~ / search / GHSA-m5ch-ppfx-xv3v

GHSA-m5ch-ppfx-xv3v

Gitea OAuth2 PKCE S256 verifier bypass

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-26247

Packages

EcosystemPackageAffectedFixed in
Go code.gitea.io/gitea < 1.25.5 1.25.5

Details

As written in the advisory (Markdown source, shown as plain text).

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.

References

External links from the advisory. They lead to third-party sites.